In May 2022, Proofpoint researchers publicly identified a new remote access trojan called “Nerbian RAT,” that uses COVID-19 and World Health Organization (WHO)-themed lures. They also determined it has significant anti-analysis and anti-reversing capabilities. Researchers detailed that Nerbian RAT is written in Golang and uses various encryption routines to bypass network analysis. The campaign was first observed by Proofpoint on April 26, 2022, when less than 100 emails were sent to various industries, mainly located in the United Kingdom, Spain, and Italy. The email contained safety measures and symptoms relating to COVID-19 in the email body and a malicious Microsoft Word attachment. When macros are enabled in Word on the victim device, the victim viewed a seven (7) page document containing COVID-19 information (specifically regarding self-isolation and how to care for those contracted with the virus) as well as logos for the Health Service Executive (HSE), Government of Ireland, and National Council for the Blind of Ireland (NCBI). The document actually executed an embedded macro that dropped a batch file that performed a PowerShell Invoke Web Request (IWR) to a specific URL, renamed the downloaded file to “UpdateUAV[.]exe”, and placed it into the victim’s “%AppData%/Roaming” folder. This executable served as a dropper for Nerbian RAT, and reused code from multiple open-source GitHub projects to integrate a significant set of anti-analysis and anti-reversing techniques prior to deployment. Certain conditions, if met, would stop execution of the tool. These conditions include “the existence of reverse engineering or debugging programs in the process list,” the name of hard disks containing the strings “virtual”, “vbox”, or “vmware”, or if the time elapsed was sufficiently long enough for the malware to assume it is being debugged. Checking for these conditions also ensures that the RAT is not running in a sandboxed, virtual environment, which is critical for long-term presence. Nerbian RAT was also observed having keylogging and screen capture capabilities, and researchers also detailed that the malware communicates to its command-and-control (C2) server over Secure Sockets Layer (SSL) with a “unique encryption scheme.” An in-depth technical analysis of Nerbian RAT as well as indicators of compromise (IOCs) can be viewed in Proofpoint’s report linked below.